Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

JoySafeter lets logged‑in users run commands on server

CVE-2026-109443 · published 16 days ago
Summary

If someone can log into JoySafeter version 1.0.0 or earlier, they can tell the system to execute any command on the underlying computer. This could let an attacker read other customers' data or steal secret information. The safest step is to upgrade to a newer version that removes this capability or apply the vendor's patch as soon as it is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
jd-opensource joysafeter <= 1.0.0
Original advisory text
JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-653Improper Isolation or Compartmentalization
Timeline
Published20 Oct 2026
Updated4 Nov 2026
First seen20 Oct 2026
Sources
CVE-2026-109443 · NVD
CVE-2026-109443 · MITRE
CVE-2026-109443 · OSV
Track software like this
Free during beta